Fluid Attacks Database

Description

Apache Thrift Node.js static web server sandbox escape The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
maven	org.apache.thrift:libthrift	>=0.9.2 <0.12.0	0.12.0
debian 11	thrift	>=0 <0.11.0-4	0.11.0-4
debian 13	thrift	>=0 <0.11.0-4	0.11.0-4
debian 12	thrift	>=0 <0.11.0-4	0.11.0-4
debian 14	thrift	>=0 <0.11.0-4	0.11.0-4
npm	thrift	>=0.9.2 <=0.11.0	0.12.0

Aliases

1. CVE-2018-117982. NVD-2018-117983. OSV-2018-117984. OSV-DEBIAN-2018-117985. GHSA-vx85-mj8c-4qm66. GCVE-2018-117987. access.redhat.com8. access.redhat.com9. SECURITY-TRACKER-CVE-2018-11798

References

1. https://github.com/apache/thrift/pull/16062. https://github.com/apache/thrift/commit/2a2b72f6c8aef200ecee4984f011e06052288ff23. https://issues.apache.org/jira/browse/THRIFT-46474. https://lists.apache.org/thread.html/6e9edd282684896cedf615fb67a02bebfe6007f2d5baf03ba52e34fd@%3Cuser.thrift.apache.org%3E5. https://web.archive.org/web/20200227094236/http://www.securityfocus.com/bid/1065016. https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html7. http://www.securityfocus.com/bid/106501

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.